1200KM / detection
T1036.002 Right-to-Left Override — Detection Rules
Detection workspace for T1036.002 Right-to-Left Override: 3 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
- Potential File Extension Spoofing Using Right-to-Left Override · test · high · {"category":"file_event","product":"windows"}
- MMC Executing Files with Reversed Extensions Using RTLO Abuse · experimental · high · {"category":"process_creation","product":"windows"}
- Potential Defense Evasion Via Right-to-Left Override · test · high · {"category":"process_creation","product":"windows"}
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0527 Right-to-Left Override Masquerading Detection via Filename and Execution Context
AN1461 Analytic 1461
Execution of files containing right-to-left override characters (U+202E) to masquerade true file extensions. Often found in phishing payloads or file downloads.
AN1462 Analytic 1462
Execution of files with reversed filename extensions using Unicode RTLO character. Frequently used to deceive Gatekeeper and users in Safari or Mail-based phishing.
AN1463 Analytic 1463
Execution of user-downloaded or created scripts with hidden extensions due to RTLO character insertion in filename, often present in desktop environments or phishing campaigns.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
T1036.002 simulation workspace
No reviewed association in this snapshot.
Threat actor context
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.